CVE-2026-61347

Windows Event Logging Service Information Disclosure Vulnerability

No known exploitation. EPSS puts it in the 32nd percentile. A vendor fix is available.

CVSS 3.15.5Medium EPSS percentile32nd0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your affected Windows version is installed (Windows 10/11 or Windows Server 2012–2025).
Verify the installed Windows updates/build includes the vendor fix for your specific branch.
Install the Microsoft update for CVE-2026-61347 using the Update Guide page below.
Reboot if your organization’s patch process requires it, then confirm the update shows as installed.
If you can’t patch immediately, reduce who has low-privilege access on the affected machines until you can update.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.

In plain language

Written by AI from the record

CVE-2026-61347 is a Windows security bug that lets a low-privilege user read hidden sensitive information from the Windows Event Logging Service; most small businesses should fix it because it’s reachable in default setups and needs only limited access.

CVE-2026-61347 is a Windows Event Logging Service buffer over-read information disclosure issue (CWE-126) where an attacker with low privileges can read memory beyond intended limits to expose confidential system information; it is reachable in default configuration without user interaction.

If you're affected

Sensitive system information exposure
Higher risk after insider access
Security monitoring data leakage
Potential follow-on account attacks

What is it

This bug lets someone with only basic access to a Windows machine “peek” at hidden parts of memory. It’s like being able to read a few extra characters you’re not supposed to see when the computer is reporting events. The main risk is that confidential system details could be exposed, which can help an attacker later.

Who is affected

This affects Windows 10, Windows 11, and multiple Windows Server versions (2012, 2012 R2, 2016, 2019, 2022, 2025) that have the Windows Event Logging Service in place. It matters to you if your machines have users or accounts that could be compromised with low privileges (for example, a disgruntled employee account or malware that already got limited access). The risk is relevant because it’s reachable in default configuration and does not require user interaction, but it does require an attacker to already have valid low-level credentials on the device.

How urgent is it

This is RED because the vulnerability is reachable in default configuration and can expose confidential system information to an attacker who already has low-level credentials. Even though it’s not currently listed as actively exploited in the provided sources, Microsoft-side urgency is reflected by patching activity, and patching closes a realistic “after-initial-access” step. Fix it urgently as part of your next patch window—or sooner if you have any indication of credential compromise.

What to do — in detail

Identify exposure
- Confirm which exact Windows edition/build you run on each endpoint/server (Windows 10/11 or the specified Windows Server versions).
- Determine which “branch” your system is on by checking the installed build number (your IT tool/Windows Update history can show this).
Confirm whether the fixed update is installed
- For each affected system, compare your installed build to the fixed versions listed by Microsoft for CVE-2026-61347.
Apply the correct fixed version (per branch)
- Windows 10:
  - fixed in 10.0.14393.9418
  - fixed in 10.0.17763.9121
  - fixed in 10.0.19044.7663
  - fixed in 10.0.19045.7663
- Windows 11:
  - fixed in 10.0.22631.7517
  - fixed in 10.0.26100.9168
  - fixed in 10.0.26200.9168
  - fixed in 10.0.28000.2704
- Windows Server 2012:
  - fixed in 6.2.9200.26280
- Windows Server 2012 R2:
  - fixed in 6.3.9600.23338
- Windows Server 2016:
  - fixed in 10.0.14393.9418
- Windows Server 2019:
  - fixed in 10.0.17763.9121
Upgrade/patch process
- Use the official Microsoft Update Guide for CVE-2026-61347 to download/apply the update for your build.
- Reboot if your update requires it, and verify the update shows as installed.
Temporary workaround if patching is delayed
- Limit low-privilege credential exposure: reduce the number of accounts that can log on with basic permissions, and rapidly remediate any signs of compromised credentials on the host.
- Strengthen access controls so an attacker cannot easily obtain the “low-level credentials” prerequisite.
What to monitor after patching
- Look for signs of abnormal local log activity from unusual accounts (especially attempts that look like local probing of system services).
- Continue to monitor for any indicators of credential theft, since this bug is most relevant after initial access.

Technical context

CVE-2026-61347 is an information disclosure vulnerability (CWE-126) in the Windows Event Logging Service caused by a buffer over-read (reading memory beyond intended limits). The findings indicate an attacker needs valid low-level credentials on the target machine, no user interaction is required, and the issue is reachable in default configuration. Public exploit code was not found in the provided sources, and there is no CISA KEV listing noted. Real-world exploitation is not confirmed in the provided reporting, but patch activity is highlighted (PULSE mentions actor Lazarus group as context for patch-related attention). The patch fixes are available as specific build numbers per OS version/branch via the MSRC Update Guide. EPSS is provided as a prediction in the findings and should not be treated as evidence of active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS32nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 32nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-11Publishedweakness classified, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

CWE-126No name in the record

Sources

References in the record

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61347

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Windows 10 Version 1607, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account